Merge pull request #204 from fancycode/youtube_html_csp

Setup CSP for YouTube sandbox.
10 years ago · 3b7b59cf66
1 changed files with 1 additions and 0 deletions
--- a/static/partials/youtubevideo_sandbox.html
+++ b/static/partials/youtubevideo_sandbox.html
@ -2,6 +2,7 @@
				@@ -2,6 +2,7 @@
 <html>
 	<head>
 		<title>YouTube Player Sandbox</title>
+		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src __PARENT_ORIGIN__ https://www.youtube.com https://s.ytimg.com 'unsafe-eval'; frame-src https://www.youtube.com; style-src 'unsafe-inline'">
 		<style type="text/css">
 		html, body {
 			height:100%;